This is the accessible text file for GAO report number GAO-14-106T
entitled 'DHS Financial Management: Continued Effort Needed to Address
Internal Control and System Challenges' which was released on November
15, 2013.
This text file was formatted by the U.S. Government Accountability
Office (GAO) to be accessible to users with visual impairments, as
part of a longer term project to improve GAO products' accessibility.
Every attempt has been made to maintain the structural and data
integrity of the original printed product. Accessibility features,
such as text descriptions of tables, consecutively numbered footnotes
placed at the end of the file, and the text of agency comment letters,
are provided but may not exactly duplicate the presentation or format
of the printed version. The portable document format (PDF) file is an
exact electronic replica of the printed version. We welcome your
feedback. Please E-mail your comments regarding the contents or
accessibility features of this document to Webmaster@gao.gov.
This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed
in its entirety without further permission from GAO. Because this work
may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this
material separately.
United States Government Accountability Office:
GAO:
Testimony:
Before the Subcommittee on Oversight and Management Efficiency
Committee on Homeland Security House of Representatives:
For Release on Delivery:
Expected at 2:00 p.m., EDT:
Thursday, October 10, 2013:
DHS Financial Management:
Continued Effort Needed to Address Internal Control and System
Challenges:
Statement of Asif A. Khan, Director:
Financial Management and Assurance:
GAO-14-106T:
Chairman Duncan, Ranking Member Barber, and Members of the
Subcommittee:
I am pleased to be here today to discuss our recent work on the
Department of Homeland Security's (DHS) efforts to improve its
financial management and reporting. Since DHS's inception in March
2003,[Footnote 1] internal control and financial management system
weaknesses have impeded its ability to provide reliable, timely, and
useful financial data to support daily operational decision making.
[Footnote 2] Those internal control and financial management system
deficiencies contributed to our decision to designate DHS's management
functions--including financial management--as high risk in 2003.
[Footnote 3] As noted in our 2013 high-risk report, continued
improvement is needed to mitigate the risks identified and to help
ensure that management weaknesses do not hinder the department's
ability to efficiently and effectively use its resources and
accomplish its mission.[Footnote 4]
The DHS Audit Requirement Target Act of 2012 requires DHS to take the
necessary steps to ensure that its fiscal year 2013 financial
statements are ready in a timely manner in order to obtain a clean
opinion.[Footnote 5] A clean opinion means that the financial
statements are presented fairly, in all material respects, in
accordance with the applicable accounting principles. DHS's financial
statements consist of the consolidated balance sheets; statements of
net cost, changes in net position, budgetary resources, and custodial
activity; and related notes. Further, DHS is required by the DHS
Financial Accountability Act of 2004[Footnote 6] to obtain an audit
opinion on its internal control over financial reporting.[Footnote 7]
A clean opinion states that, in the auditors' opinion, the entity
maintained effective internal control over financial reporting.
We have long held that accountability is part of the organizational
culture that goes well beyond receiving a clean audit opinion on the
financial statements; the underlying premise is that agencies must
become more results-oriented, cost conscious, and focused on internal
control. A disciplined and structured approach to assessing internal
control is critical to successfully implement and maintain adequate
financial management oversight in the federal government.
My remarks today are primarily based on our September 2013 report on
DHS financial management issues.[Footnote 8] Accordingly, this
testimony addresses DHS's progress toward (1) obtaining a clean
opinion on its financial statements; (2) obtaining a clean opinion on
its internal control over financial reporting; and (3) modernizing its
financial systems, including the extent to which DHS's approach for
modernizing its current financial systems was consistent with Office
of Management and Budget (OMB) requirements. We also discuss whether
DHS followed certain information technology (IT) best practices while
implementing its approach. For our report, we reviewed relevant DHS
guidance and documents, determined whether DHS followed OMB
requirements and certain industry best practices, and interviewed key
DHS officials. We updated this statement for new information obtained
from DHS since the issuance of our report related to DHS's schedule
for completing its financial system modernization efforts. This work
was performed in accordance with generally accepted government
auditing standards. Those standards require that we plan and perform
the audit to obtain sufficient, appropriate evidence to provide a
reasonable basis for our findings and conclusions based on our audit
objectives. Our report provides further details on our scope and
methodology.
In summary, we found DHS:
* has made considerable progress toward generating reliable financial
data to obtain a clean opinion on its financial statements;
* has made limited progress in establishing effective controls to
obtain a clean opinion on its internal control over financial
reporting; and:
* is in the early planning stages of implementing its decentralized
approach with each component determining the specific solution for its
financial systems modernization.
Opinion on Financial Statements:
DHS's progress on obtaining a clean opinion on its financial
statements includes reducing the number of audit qualifications from
11 in 2005 to 1 in 2010;[Footnote 9] receiving a qualified audit
opinion on two of its five fiscal year 2011 financial statements--the
consolidated balance sheet and statement of custodial
activity;[Footnote 10] expanding the financial audit in fiscal year
2012 to all financial statements; and obtaining a qualified opinion on
the fiscal year 2012 financial statements.[Footnote 11] DHS was able
to achieve this progress based in part on management's commitment to
improving its financial management process.
DHS is working to resolve the deficiencies in the U.S. Coast Guard's
(USCG)--one of DHS's major component entities--ability to complete
certain reconciliations and provide evidence supporting certain
components of general property, plant, and equipment (PP&E), as well
as heritage and stewardship assets that caused its auditors to issue a
qualified opinion on its fiscal year 2012 financial statements. DHS
has a goal of achieving a clean opinion for fiscal year 2013. However,
the auditors' report indicates that DHS continues to rely on
compensating controls and complex manual work-arounds to support its
financial reporting, rather than sound internal control over financial
reporting and effective financial management systems.
Opinion on Internal Control:
In regard to DHS's progress on obtaining a clean opinion on internal
control over financial reporting, from fiscal years 2005 through 2011,
DHS's auditors reported a reduction in the number of material
weaknesses in internal control over financial reporting from 10 to 5
and a decrease in the number of control deficiencies contributing to
the material weaknesses from 30 to 15.[Footnote 12] Although the
number of auditor-reported material weaknesses in DHS's internal
control over financial reporting has decreased since fiscal year 2005,
the largest reduction--for fiscal year 2007--was due to a
consolidation of weaknesses into fewer, broader categories for
reporting purposes.[Footnote 13] For fiscal year 2012, the most
recently completed audit, DHS's auditors reported material weaknesses
in five areas related to deficiencies at eight components, including
USCG.
The material weaknesses reported in fiscal year 2012 include (1)
financial reporting, (2) IT controls and financial system
functionality, (3) property, plant, and equipment, (4) environmental
and other liabilities, and (5) budgetary accounting.[Footnote 14]
According to DHS's auditors, the existence of these material
weaknesses limits DHS's ability to process, store, and report
financial data in a manner that ensures accuracy, confidentiality,
integrity, and availability of data without substantial manual
intervention. DHS has plans to resolve the remaining five material
internal control weaknesses, with a goal of achieving a clean opinion
on internal control over financial reporting for fiscal year 2016. DHS
will continue to face challenges in obtaining and sustaining a clean
opinion on its financial statements and attaining a clean opinion on
its internal control over financial reporting until serious internal
control and financial management systems deficiencies are resolved.
Financial Management Systems:
For nearly a decade, DHS tried to modernize its financial management
systems by attempting to implement a department-wide integrated
financial management system. DHS's efforts included two projects--one
that ended in December 2005 when DHS acknowledged that its pilot
project had not been successful, and another in June 2011 when
requirements had changed and DHS canceled the program. Now, under its
decentralized approach, DHS plans to modernize the financial systems
of components with the most critical need first and integrate the
financial systems with asset management and acquisition systems,
resulting in component-level integrated financial management systems.
DHS determined that components with a critical business need to
modernize their financial management systems include Immigration and
Customs Enforcement and USCG, and their customer components, as well
as the Federal Emergency Management Agency. Components are in the
early planning stages of implementing the approach, and as of
September 2013, DHS estimated that its financial system modernization
efforts will not be completed until fiscal year 2018.
In our September 2013 report, we found that DHS's decentralized
approach for modernizing its components' financial systems is
consistent with relevant OMB requirements, such as implementing
projects in smaller, simpler segments, but not all relevant IT best
practices have been fully implemented. DHS has implemented certain IT
recommended best practices that reflect key areas of effective program
management, such as conducting an analysis of alternatives,
establishing a governance structure, developing financial management
systems baseline business process requirements, and developing a
description of its current financial management environment. However,
DHS had not fully incorporated other IT best practices, including
developing a description of how its components' financial management
systems will operate in the future--called a detailed target state--or
a description of how components will transition to a new financial
management environment--called a department-level transition plan.
[Footnote 15]
To help DHS deploy component-level integrated financial management
systems, we made two recommendations to DHS regarding the need to
follow best practices related to its target state and transition plan.
After reviewing the draft report, DHS generally agreed with our
recommendations and described actions already taken to address them.
However, we believe that further action is needed to address these
recommendations. Specifically, DHS has not developed other important
details for its target state, such as department-level operational
needs and characteristics, including the systems' availability, data
flow, expandability, and interoperability. In addition, its transition
strategy is missing needed elements of a transition plan such as
milestones and time frames for implementing new systems as well as the
optimal sequencing of activities. Without a detailed target state and
department-level transition plan, DHS has an increased risk of, among
other things, investing in and implementing systems that do not
provide the desired capabilities and inefficiently using resources
during its financial management system modernization efforts.
With regard to the status of DHS's efforts to complete actions
necessary to achieve removal from our high-risk list, in a September
2010 letter to DHS, we identified, and DHS subsequently agreed to
achieve, 31 actions and outcomes, including 9 related to financial
management, that are critical to addressing the high-risk issues and
challenges within the department's management areas.[Footnote 16]
Based on our recent review, we determined that DHS has made progress
improving its financial management and fully addressing two of the
nine high-risk financial management actions and outcomes--obtaining
top management commitment and developing corrective action plans.
[Footnote 17] However, a significant amount of work remains to be
completed on the remaining seven financial management actions and
outcomes, which include obtaining and sustaining a clean opinion on
its financial statements, addressing weaknesses in internal controls
and systems to obtain an opinion on the effectiveness of internal
control over financial reporting, ensuring that its financial systems
substantially comply with the Federal Financial Management Improvement
Act of 1996,[Footnote 18] and deploying modern financial systems at
certain components. Achieving these outcomes will greatly enhance
DHS's ability to produce reliable, timely, and useful financial
information to support operational decision making, and thus assist it
in efficiently and effectively using its resources to accomplish its
mission.
Chairman Duncan, Ranking Member Barber, and Members of the
Subcommittee, this concludes my prepared remarks. I would be happy to
answer any questions that you may have.
GAO Contact and Staff Acknowledgments:
For future contacts regarding this statement, please contact Asif Khan
at (202) 512-9869 or at khana@gao.gov. Contact points for our Offices
of Congressional Relations and Public Affairs may be found on the last
page of this statement. Michael LaForge, Assistant Director; Laura
Pacheco; and Leonardo Zapata made key contributions to this statement.
[End of section]
Footnotes:
[1] In March 2003, DHS was created by merging 22 disparate agencies
and organizations, many of which had known financial management
weaknesses and vulnerabilities. Only 5 of the agencies that
transferred to DHS had been subject to financial statement audits--
U.S. Customs Service, Transportation Security Administration,
Immigration and Naturalization Service, Federal Emergency Management
Agency, and Federal Law Enforcement Training Center. DHS currently
comprises 16 component entities.
[2] Internal control is a major part of managing an organization and
comprises the plans, methods, and procedures used to meet missions,
goals, and objectives and, in doing so, supports performance-based
management. GAO, Standards for Internal Control in the Federal
Government, [hyperlink,
http://www.gao.gov/products/GAO/AIMD-00-21.3.1] (Washington, D.C.:
November 1999) provides an overall framework for establishing and
maintaining internal control and for identifying and addressing major
performance and management challenges and areas at greatest risk of
fraud, waste and abuse, and mismanagement.
[3] GAO, High-Risk Series: An Update, [hyperlink,
http://www.gao.gov/products/GAO-03-119] (Washington, D.C.: January
2003).
[4] GAO, High-Risk Series: An Update, [hyperlink,
http://www.gao.gov/products/GAO-13-283] (Washington, D.C.: February
2013).
[5] Pub. L. No. 112-217, § 2(b), 126 Stat. 1591 (Dec. 20, 2012).
[6] Pub. L. No. 108-330, § 4(a), 118 Stat. 1277 (Oct. 16, 2004).
[7] The objectives of internal control over financial reporting are to
provide reasonable assurance that (1) transactions are properly
recorded, processed, and summarized to permit the preparation of the
financial statements in conformity with U.S. generally accepted
accounting principles, and assets are safeguarded against loss from
unauthorized acquisition, use, or disposition, and (2) transactions
are executed in accordance with laws governing the use of budget
authority and with other laws and regulations that could have a direct
and material effect on the financial statements.
[8] GAO, DHS Financial Management: Additional Efforts Needed to
Resolve Deficiencies in Internal Controls and Financial Management
Systems, [hyperlink, http://www.gao.gov/products/GAO-13-561]
(Washington, D.C.: Sept. 30, 2013).
[9] An audit qualification is a matter identified by auditors that
contributes to their inability to render a clean opinion on the
financial statements.
[10] Auditors reported that (1) the other three financial statements,
including the statements of net cost, changes in net position, and
budgetary resources, were not auditable, and (2) DHS must be able to
represent that its balance sheet is fairly stated, and obtain at least
a qualified opinion before it is practical to extend the audit to
other financial statements.
[11] A qualified opinion, in relation to the financial statements,
states that certain reported balances are unauditable, or the
financial statements contain a material departure from generally
accepted accounting principles, or both.
[12] A material weakness is a significant deficiency, or a combination
of significant deficiencies, in internal control such that there is a
reasonable possibility that a material misstatement of the entity's
financial statements will not be prevented, or detected and corrected,
on a timely basis. A significant deficiency is a control deficiency,
or combination of deficiencies, in internal control important enough
to merit attention by those charged with governance. A control
deficiency exists when the design or operation of a control does not
allow management or employees, in the normal course of performing
their assigned functions, to prevent, or detect and correct,
misstatements on a timely basis.
[13] For fiscal year 2007, auditors consolidated certain material
weaknesses by combining (1) intragovernmental balances into the
financial reporting material weakness; (2) PP&E with the operating
materials and supplies material weakness and reporting the combination
as capital assets and supplies; and (3) actuarial liabilities with the
legal and other liabilities and reported the combination as actuarial
and other liabilities. The auditors noted that DHS had made progress
during fiscal year 2007 in remediating the deficiency related to
intragovernmental balances. USCG was the only DHS component that
contributed to the fiscal year 2006 material weaknesses in operating
materials and supplies and actuarial liabilities, but the auditors did
not report that USCG had made progress during fiscal year 2007 in
remediating the deficiencies within operating materials and supplies
and actuarial liabilities.
[14] For detailed information on the five material weaknesses, see
[hyperlink, http://www.gao.gov/products/GAO-13-561], appendix IV.
[15] We also had two other findings and recommendations in our report
related to IT best practices and the need for DHS, at the time of our
review, to update its standard operating procedures and include
specific procedures for revising milestone dates and providing written
confirmation of completed activities reflected in its integrated
master schedule and for performing key elements of a lessons learned
process. After DHS received our draft report for comment, DHS
finalized its procedures to resolve these issues, and we agreed that
DHS had completed actions to address these two recommendations.
[16] For a list and discussion of the 31 actions and outcomes, see
GAO, Department of Homeland Security: Continued Progress Made
Improving and Integrating Management Areas, but More Work Remains,
[hyperlink, http://www.gao.gov/products/GAO-12-1041T] (Washington,
D.C.: Sept. 20, 2012); and High-Risk Series: Government-wide 2013
Update and Progress Made by the Department of Homeland Security,
[hyperlink, http://www.gao.gov/products/GAO-13-444T] (Washington,
D.C.: Mar. 21, 2013).
[17] For detailed information on the nine financial management actions
and outcomes, see [hyperlink, http://www.gao.gov/products/GAO-13-561],
appendix II.
[18] Pub. L. No. 104-208, div. A, title VIII, 110 Stat. 3009, 3009-389
(Sept. 30, 1996).
[End of section]
GAO’s Mission:
The Government Accountability Office, the audit, evaluation, and
investigative arm of Congress, exists to support Congress in meeting
its constitutional responsibilities and to help improve the
performance and accountability of the federal government for the
American people. GAO examines the use of public funds; evaluates
federal programs and policies; and provides analyses, recommendations,
and other assistance to help Congress make informed oversight, policy,
and funding decisions. GAO’s commitment to good government is
reflected in its core values of accountability, integrity, and
reliability.
Obtaining Copies of GAO Reports and Testimony:
The fastest and easiest way to obtain copies of GAO documents at no
cost is through GAO’s website [hyperlink, http://www.gao.gov]. Each
weekday afternoon, GAO posts on its website newly released reports,
testimony, and correspondence. To have GAO e-mail you a list of newly
posted products, go to [hyperlink, http://www.gao.gov] and select
“E-mail Updates.”
Order by Phone:
The price of each GAO publication reflects GAO’s actual cost of
production and distribution and depends on the number of pages in the
publication and whether the publication is printed in color or black
and white. Pricing and ordering information is posted on GAO’s
website, [hyperlink, http://www.gao.gov/ordering.htm].
Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
TDD (202) 512-2537.
Orders may be paid for using American Express, Discover Card,
MasterCard, Visa, check, or money order. Call for additional
information.
Connect with GAO:
Connect with GAO on facebook, flickr, twitter, and YouTube.
Subscribe to our RSS Feeds or E mail Updates. Listen to our Podcasts.
Visit GAO on the web at [hyperlink, http://www.gao.gov].
To Report Fraud, Waste, and Abuse in Federal Programs:
Contact:
Website: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm];
E-mail: fraudnet@gao.gov;
Automated answering system: (800) 424-5454 or (202) 512-7470.
Congressional Relations:
Katherine Siggerud, Managing Director, siggerudk@gao.gov:
(202) 512-4400:
U.S. Government Accountability Office:
441 G Street NW, Room 7125:
Washington, DC 20548.
Public Affairs:
Chuck Young, Managing Director, youngc1@gao.gov:
(202) 512-4800:
U.S. Government Accountability Office:
441 G Street NW, Room 7149:
Washington, DC 20548.
[End of document]